5891 matches found
CVE-2024-57175
CVE-2024-57175: PHPGURUKUL ऑनलाइन जन्म प्रमाणपत्र प्रणाली v1.0 में संग्रहीत क्रॉस-साइट स्क्रिप्टिंग XSS विवरण PHPGURUKUL ऑनलाइन जन्म प्रमाणपत्र प्रणाली v1.0 में /user/certificate-form.php पृष्ठ पर एक संग्रहीत क्रॉस-साइट स्क्रिप्टिंग XSS भेद्यता की पहचान की गई। यह भेद्यता प्रमाणित उपयोगकर्ताओं को...
vi-bot
BotDetect v2 — Libreria di Rilevamento Bot per Produzione Libreria client-side per il rilevamento di bot e automazione con punteggio ponderato, analisi comportamentale, fingerprinting del browser e soglie configurabili. Rileva browser headless, Selenium, Puppeteer, Playwright, strumenti basati su...
CVE-2021-43032
CVE-2021-43032 XenForo ≤ 2.2.7 में, एक खतरा कारक जिसके पास एडमिन पैनल तक पहुंच है, वह एप्लिकेशन के किसी भी फंक्शन में क्रॉस-साइट स्क्रिप्टिंग पेलोड को सेव कर सकता है जो HTML कोड स्वीकार करता है। 'Advertising' कार्यक्षमता में रखा गया पेलोड क्लाइंट साइड पर वैश्विक रूप से निष्पादित होगा, जिससे कई शो...
awxkit: path traversal via YAML !include directive
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...
awxkit: path traversal via YAML !include directive
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...
awxkit: path traversal via YAML !include directive
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...
CVE-2022-46485
CVE-2022-46485 ngDoS - ngSurvey Notas: A pergunta "slider" também pode ser vulnerável com um número inteiro grande em vez de uma string. Não pôde ser confirmado no meu ambiente local. Passos de exploração Abra a página da pesquisa e encontre um campo de texto ou comentário. Preencha a pesquisa...
CloakBin
CloakBin Pastebin crittografato a conoscenza zero I tuoi dati vengono crittografati prima di lasciare il tuo browser. Noi non possiamo leggerli. Nessuno può. Demo dal vivo • Segnala bug • Richiedi funzionalità Perché a conoscenza zero? I pastebin tradizionali memorizzano i tuoi dati in chiaro. Gl...
PublicSafe
PublicSafe Il tuo browser, il tuo spazio sicuro PublicSafe è un'estensione del browser gratuita e open-source incentrata su privacy, crittografia e controllo dell'utente. Fornisce strumenti di crittografia lato client progettati per aiutare gli utenti a proteggere le informazioni sensibili prima...
PT-2026-81048
Name of the Vulnerable Software and Affected Versions Boost versions prior to 2.0.5 Description An unauthenticated Cross-Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the context of a user's session without requiring prior authentication. Recommendation...
ppfuzz
ppfuzz Fuzzer per Prototype Pollution Un veloce strumento per scansionare la vulnerabilità di prototype pollution lato client scritto in Rust. 🦀 Installazione Binario Sorgente Dipendenze Dimostrazione Utilizzo Base Opzioni Utilizzo Materiali di supporto Contribuire Attribuzione Riconoscimenti...
ppfuzz
ppfuzz Prototype Pollution Fuzzer A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀 Installation Binary Source Dependencies Demonstration Usage Basic Options Usage Supporting Materials Contributing Attribution Acknowledments License Installation...
JS-Secret-Hunter
JS Secret Hunter V2 🕵️♂️ JS Secret Hunter è uno strumento Python avanzato progettato per i ricercatori di sicurezza al fine di automatizzare il rilevamento di segreti hardcoded nel JavaScript lato client. A differenza dei semplici scanner, V2 include un crawler dinamico che analizza l'HTML del...
cs-get-last-error
cs-get-last-error Ottieni i messaggi di errore dai codici di GetLastError direttamente all'interno del client Cobalt Strike senza l'aiuto di Google search, net helpmsg o Microsoft Error Lookup Tool. I messaggi di errore sono inclusi nell'aggressor script e non è richiesta alcuna interazione con i...
CVE-2024-41290
CVE-2024-41290 FlatPress CMS v1.3.1 1.3 foi descoberto utilizando métodos inseguros para armazenar dados de autenticação Informações Adicionais: FlatPress CMS versão 1.3.1 armazena de forma insegura dados relacionados à autenticação, incluindo nomes de usuário e senhas com hash, diretamente em...
dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset
A flaw was found in DOMPurify where the clearConfig function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could...
dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset
A flaw was found in DOMPurify where the clearConfig function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could...
html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping
A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting XSS. An...
CVE-2026-77080 n8n before 1.123.69 Arbitrary File Read and Write via Snowflake
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions...